CVE-2026-90257
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: avoid OOB read of build info string The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build Information) and hands the response to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at skb->data + 1, without checking the length. A backend that answers with status only leaves that pointer past the end of the received data, so the walk reads adjacent slab memory until it meets a NUL. Those bytes reach the kernel log and the firmware-info debugfs file. To fix this, print the string with a bounded "%.*s" limited to skb->len - 1. A short or unterminated response then prints as much as arrived instead of failing setup. This mirrors commit dd068ef04412 ("Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()"), which fixed the identical pattern.
Affected versions
Linux kernel versions
5.13
and later are affected. Fixed in
5.15.221,
6.1.188,
6.6.157,
6.12.110,
6.18.52,
7.2.6,
7.3-rc1
and their respective stable series.
References
7 totalFrequently asked questions
-
What is CVE-2026-90257?
CVE-2026-90257 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.13 onward and has been patched in 5.15.221, 6.1.188, 6.6.157 and others. CVE-2026-90257 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-90257?
Yes. CVE-2026-90257 has been patched. Fixed versions include 5.15.221, 6.1.188, 6.6.157 and others. If you are running Linux kernel 5.13 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-90257 actively exploited?
No. CVE-2026-90257 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.